IT security assessment
A structured audit that runs from access management through updates, backup, and the network to user security.
What we examine
Five areas in one audit
Attackers usually get in through the weakest point, so none of these areas can be left out.
Access management
Who can access what, with which authentication, and what happens to their permissions when people join, change roles, and leave.
Updates
The update status of operating systems and third-party applications.
Backup
Whether you can actually recover after an incident, or only according to the backup log.
Network
Which devices make up the network and how they connect to each other.
User security
The risk that comes from your staff: how they handle passwords and how exposed they are to phishing messages.
Order matters
First we assess what needs protecting
We only talk about products after the assessment. Without it, every further decision would be guesswork.
The executive summary and the oral presentation are meant for the people who decide on the actions and the budget. We cover how the assessment runs in more detail in our article on IT security assessments.
Deliverables
What you get at the end
items handed over
- Detailed assessment report with a risk rating for each area
- Network asset inventory and topology map
- 90-day priority list with specific actions and cost estimates
- Executive summary and oral presentation
Related services
When an area needs a closer look
We also cover each of these areas in a separate, detailed audit.
Firewall configuration hardening audit
An audit of the rule set and settings of your existing firewalls against accepted security recommendations.
Microsoft 365 security hardening
We check and fix the authentication, sharing, email, and logging settings of your Microsoft 365 and Entra ID tenant.
Active Directory review and hardening
Active Directory is the first target of ransomware attacks. We audit permissions, accounts, and settings, then close off the attack paths.
Backup and disaster recovery
We review or design your backup system following the 3-2-1 rule, with immutable backups and a disaster recovery plan.
Frequently asked questions
What people usually ask before an assessment
Will we have to replace our existing tools after the assessment?
In most cases, no. Organizations typically use only a fraction of what the tools they have already bought can do: the firewall can segment, the endpoint protection can do behavior-based detection, but nobody has configured them. We recommend new purchases only where there is a real capability gap.
Why do we need a network asset inventory and a topology map?
An attacker rarely stops at the first compromised machine: they move laterally inside the network toward the real target. The topology map shows where these paths lead and where separation between systems is missing.
Our backup is fine. Why examine it anyway?
Most organizations believe their backup is fine until the first real restore. A targeted attacker deliberately destroys the backups before starting the encryption. A quick self-test: if the domain administrator account can log in to the backup system and delete data there, an attacker can do the same. Our article on backup strategy has the details.
